Lucene search

VulDBCVE-2024-7463

HistoryAug 05, 2024 - 1:16 a.m.

CVE-2024-7463

2024-08-0501:16:07

CWE-120

VulDB

web.nvd.nist.gov

totolink cp900

remote buffer overflow

critical vulnerability

file manipulation

public exploit

vdb-273556

unresponsive vendor

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

65.6%

JSON

A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Nvd

Node

totolinkcp900_firmwareMatch6.3c.566

AND

totolinkcp900Match-

VendorProductVersionCPE
totolinkcp900_firmware6.3c.566cpe:2.3:o:totolink:cp900_firmware:6.3c.566:*:*:*:*:*:*:*
totolinkcp900-cpe:2.3:h:totolink:cp900:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	cp900_firmware	6.3c.566	cpe:2.3:o:totolink:cp900_firmware:6.3c.566:::::::*
totolink	cp900	-	cpe:2.3:h:totolink:cp900:-:::::::*

CNA Affected

[
  {
    "vendor": "TOTOLINK",
    "product": "CP900",
    "versions": [
      {
        "version": "6.3c.566",
        "status": "affected"
      }
    ]
  }
]

References

github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP900/UploadCustomModule.md

vuldb.com/?ctiid.273556

vuldb.com/?id.273556

vuldb.com/?submit.381333

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

65.6%

JSON

Related for CVE-2024-7463